Function may_read_some_row 

pub fn may_read_some_row(
    allow: &[ReadPolicy],
    deny: &[ReadPolicy],
    ctx: &CratestackContext,
) -> bool

Whether some row could pass allow/deny for ctx: an @allow can be True, and no @deny fires on every row (it fires on anything but False). An empty allow list denies, as on every read.